Query user login over a period of time

[Skadrir]

I am trying to query our windows and linux indexes to verify how many times a user has logged in over a period of time.

Currently, I only care about the last 7 days. I've tried to run some queries, but it's not very fruitful.

Can I gain some assistance with generating a query for determining the number of logins over a period of time, please?

Thank you.

[fredclown · Accepted solution]

Is something like this what you are looking for? Set the time range picker to your desired range.

index=windows EventCode=4624 Account_Name IN ("Larry","Curly","Moe")
| eval Logon_Account_Name=mvindex(Account_Name, 1)
| table _time, ComputerName, Logon_Account_Name
| sort _time

[Skadrir]

I tailored the query to the appropriate fields and viola it worked.

I appreciate your efforts and thank you for your time.

[yuanliu]

This is a Splunk forum.  No one here knows what your data source looks like. To ask an answerable data analytics question, follow these golden rules; nay, call them the four commandments:

• Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search that volunteers here do not have to look at.
• Illustrate the desired output from illustrated data.
• Explain the logic between illustrated data and desired output without SPL.
• If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious.

[Skadrir]

Effectively I want to comb through the windows event logs to determine logon dates and times for a specific user(s) and output those entries into a table with username, date and time. We have a windows index and we want to query the last seven days and the number of logins for a given user.

I would imagine it'd be fairly simple to do, I just don't SPL. This is why I engaged the brain trust online in this forum. I don't splunk as a day job, so I'm not familiar with the intricacies with SPL.

In short, give all entries from windows security logs for the last seven days from the windows index for a specific user with event ID 4624.

Thank you.